1CO. 


Information Commissioner’s Office 


Consultation: Age appropriate design code 


Introduction 


The Information Commissioner is seeking feedback on her draft code of practice Age appropriate 
design: a code of practice for online services likely to be accessed by children (the code). 


The code will provide guidance on the design standards that the Commissioner will expect 
providers of online ‘Information Society Services’ (ISS), which process personal data and are likely 
to be accessed by children, to meet. 


The code is now out for public consultation and will remain open until 31 May 2019. The 
Information Commissioner welcomes feedback on the specific questions set out below. 


For this consultation, we will publish all resoonses except for those where the respondent indicates 
that they are an individual acting in a private capacity (e.g. a member of the public or a parent). All 
responses from organisations and individuals responding in a professional capacity (e.g. 
academics, child development experts, sole traders, child minders, education professionals) will be 
published. We will remove email addresses and telephone numbers from these responses but 
apart from this, we will publish them in full. 


For more information about what we do with personal data please see our privacy notice. 


Please note, we are using the platform Snap Surveys to gather this information. Any data collected 
by Snap Surveys for ICO is stored on UK servers. You can read their Privacy Policy here. 


Section 1: Your views on the code 


Is the ‘About this code’ section clearly communicated? 
Ql @ Yes 
O No 


If no, then please provide your reasons for this view. 
Qila 


Is the 'Services covered by this code' section clearly communicated? 
Q2 @ Yes 


©) No 


If no, then please provide your reasons for this view. 
Q2a 


Section 2: Your views on the draft standards 


There are 16 draft standards in the code. You can comment on all the drafts 
standards, or focus on a single standard. If you do not want to answer questions on a 
standard please press skip. 


The standards are: 


3) Transparency 

4) Detrimental use of data 

5) Policies and community standards 
6) Default settings 


8) Data sharing 

9) Geolocation 

10) Parental Controls 

11) Profiling 

12) Nudge techniques 

13) Connected toys and devices 

14) Online tools 

15) Data protection impact assessments 
16) Governance and accountability 


Q4 


Best interests of the child: The best interests of the child should be a primary 


consideration when you design and develop online services likely to be accessed 
by a child. 


© I would like to comment on this standard 


©) Skip 


Have we communicated our expectations for this standard clearly? 
©) Yes 

© No 

If no, then please give reasons for your answer. 


I think it's important to ensure that "best interest" is user-centred around the child, 
and time-constrained so the judgement of best interest is immediate and not time- 
delayed. I've seen examples of where "in the best interest" is from an adult's 
perspective but which can harm the child (e.g. causing friendship conflict), similarly 
where the judgement of "best interest" is considered as "ultimately this is the best for 
the child long term, even though it might cause that child issues in the short term". 
These should be avoided: I wish therefore that the standard mentioned "think from 
the child's perspective" i.e. ux design and "think about their best interest in the short 
and long term". 


Q5 


Q5a 


Q6 


Q6a 


Q7 


Q7a 


©) Yes 
© No 


If yes, then please give reasons for your answer. 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 

O Yes 

© No 


If yes, then please give reasons for your answer. 


Do you envisage any feasibility challenges to online services delivering this 
standard? 

O Yes 

© No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q8 ©) Yes 
© No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q8a 


Q9 Q Yes 


© No 


If yes, then please provide details (including links). 


Q9a 
an © I would like to comment on this standard 

©) Skip 

Have we communicated our expectations for this standard clearly? 
Q11 © Yes 


© No 


Qila I would like a reference to the importance of different age bands at the front (in the 
summary) together with the clear definition (those under 18) rather than leaving it 
buried in the main content on page 13. 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 

Q12 @ Yes 
©) No 


Q1i2a Co-developed surveys for children in foster care with Professor Julie Selwyn and the 
charity Coram Voice - different age appropriate surveys are for 4-7 year olds, 8-10 
and 11-17. In these cases the user testing highlighted the importance of using simple 
words and concepts. For adults, sometimes words can convey a complex concept that 
just isn't understood by children, in which case asking about the concept itself is just 
not possible remotely. We worked hard on this - definitely some useful insight here 
that could be shared. 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 

Q13 ©) Yes 
© No 


If yes, then please give reasons for your answer. 
Qi3a 


Q14 @ Yes 
O No 


Qi4a In practice, younger children may view content intended for older children - how can 
suppliers anticipate, measure and respond to this if it occurs? 


Q15 © Yes 
© No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q15a 


Q16 ©) Yes 
© No 


If yes, then please provide details (including links). 
Q16a 


ansparency: The privacy information you provide to users, and other 
TEE terms, policies and community standards, must be concise, 
prominent and in clear language suited to the age of the child. Provide 
additional specific ‘bite-sized’ explanations about how you use personal data at 
the point that use is activated. 


Q17 ' I would like to respond to this standard 


© Skip 


Have we communicated our expectations for this standard clearly? 
Q18 () Yes 
J) No 
If no, then please give reasons for your answer. 


Q18a 
Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 
Q19 () Yes 
S ' No 
If yes, then please give reasons for your answer. 
Q19a 
Do you think this standard gives rise to any unwarranted or unintended 
consequences? 
Q20 () Yes 
`) No 


If yes, then please give reasons for your answer. 
Q20a 


Do you envisage any feasibility challenges to online services delivering this standard? 
Q21 () Yes 
No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q21a 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


O22 Yes 


No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q22a 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Q23 Yes 
© No 
If yes, then please provide details (including links). 
Q23a 
Detrimental use of data: Do not use children’s personal data in ways that 
have been shown to be detrimental to their wellbeing, or that go against 
industry codes of practice, other regulatory provisions or Government advice. 
Q24 


I would like to respond to this standard 


© skip 


Have we communicated our expectations for this standard clearly? 


Q25 (©) Yes 
No 
If no, then please give reasons for your answer. 
Q25a 
Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 
Q26 Yes 
No 
If yes, then please give reasons for your answer. 
Q26a 
Do you think this standard gives rise to any unwarranted or unintended 
consequences? 
Q27 Yes 
`) No 
If yes, then please give reasons for your answer. 
Q27a 


Do you envisage any feasibility challenges to online services delivering this standard? 
Q28 () Yes 


No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q28a 


Q29 


Q29a 


Q30 


Q30a 


Q31 


Q32 


Q32a 


Q33 


Q33a 


Do you think this standard requires a transition period of any longer than 3 
months after the code comes into force? 


() Yes 

O) No 

If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


() Yes 
©) No 
If yes, then please provide details (including links). 


Policies and community standards: Uphold your own published terms, 
policies and community standards (including but not limited to privacy policies, 
age restriction, behaviour rules and content policies). 


© skip 


Have we communicated our expectations for this standard clearly? 
©) Yes 

~) No 

If no, then please give reasons for your answer. 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


(_) Yes 
©) No 
If yes, then please give reasons for your answer. 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Q34 (©) Yes 
©) No 


If yes, then please give reasons for your answer. 


Q34a 
Do you envisage any feasibility challenges to online services delivering this 
standard? 

Q35 ©) Yes 


©) No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q35a 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


Q36 ©) Yes 
©) No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q36a 


Do you know of any online resources that you think could be usefully linked to 
from this section of the code? 


Q37 © Yes 
©) No 


If yes, then please provide details (including links). 
Q37a 


Default settings: Settings must be ‘high privacy’ by default (unless you can 
demonstrate a compelling reason for a different default setting, taking account 
of the best interests of the child). 

Q38 () I would like to respond to this standard 


© Skip 


Have we communicated our expectations for this standard clearly? 
Q39 Ọ Yes 

©) No 

If no, then please give reasons for your answer. 
Q39a 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Q40 Yes 
No 
If yes, then please give reasons for your answer. 
Q40a 
Do you think this standard gives rise to any unwarranted or unintended 
consequences? 
Q41 Yes 
`) No 
If yes, then please give reasons for your answer. 
Q41a 
Do you envisage any feasibility challenges to online services delivering this standard? 
Q42 (|) Yes 


No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q42a 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


Q43 ©) Yes 
O No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q43a 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Q44 ©) Yes 
O No 


If yes, then please provide details (including links). 


Q44a 


Q45  @ I would like to respond to this standard 


©) Skip 


Q46 @ Yes 
O No 


If no, then please give reasons for your answer. 
Q46a 


Q47 ©) Yes 
© No 


If yes, then please give reasons for your answer. 
Q47a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 
Q48 @ Yes 
O No 
If yes, then please give reasons for your answer. 


Q48a_ I think it should be a standard expectation that full names are never taken, and that 
service providers actively encourage the use of nicknames, pseudonyms etc. 


Do you envisage any feasibility challenges to online services delivering this standard? 
Q49 (©) Yes 
© No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q49a 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 
Q50 Ọ Yes 


© No 


If yes, then please provide your reasons for this view, and give an indication of what 


you think a reasonable transition period would be and why. 
Q50a 


this section of the code? 
Q51 (©) Yes 
© No 


If yes, then please provide details (including links). 
Q51a 


Data sharing: Do not disclose children’s data unless you can demonstrate a 
compelling reason to do so, taking account of the best interests of the child. 


©) I would like to respond to this standard 
© Skip 


Q52 


Have we communicated our expectations for this standard clearly? 
Q53 Ọ Yes 
O No 


If no, then please give reasons for your answer. 


Q53a 
Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 

Q54 (©) Yes 


©) No 


If yes, then please give reasons for your answer. 
Q54a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Q55 Yes 
No 
If yes, then please give reasons for your answer. 
Q55a 


Do you envisage any feasibility challenges to online services delivering this standard? 
Q56 Yes 


No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q56a 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


Q57 Yes 


No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q57a 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Q58 Yes 
`) No 
If yes, then please provide details (including links). 
Q58a 


Q59 


Q60 


Q60a 


Q61 


Q6ia 


Q62 


Q62a 


Q63 


Q63a 


Geolocation: Switch geolocation options off by default (unless you can 
ETE a compelling reason for geolocation, taking account of the best 
interests of the child), and provide an obvious sign for children when location 
tracking is active. Options which make a child's location visible to others must 
default back to off at the end of each session. 


I would like to respond to this standard 


© Skip 


Have we communicated our expectations for this standard clearly? 
`) Yes 
No 
If no, then please give reasons for your answer. 


Do you have any examples that you think could be used to illustrate the 
approach we are advocating to this standard? 


Yes 
No 
If yes, then please give reasons for your answer. 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Yes 
No 
If yes, then please give reasons for your answer. 


Do you envisage any feasibility challenges to online services delivering this 
standard? 


Yes 
No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q64 


Q64a 


Q65 


Q65a 


Q66 


Q67 


Q67a 


Q68 


Q68a 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


Yes 


No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Yes 


No 
If yes, then please provide details (including links). 


ental controls: If you provide parental controls give the child age 
E information about this. If your online service allows a parent or 
carer to monitor their child's online activity or track their location, provide an 
obvious sign to the child when they are being monitored. 


I would like to respond to this standard 


© Skip 


Have we communicated our expectations for this standard clearly? 
`) Yes 


No 
If no, then please give reasons for your answer. 


Do you have any examples that you think could be used to illustrate the 
approach we are advocating to this standard? 


Yes 


) No 
If yes, then please give reasons for your answer. 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Q69 Yes 
No 
If yes, then please give reasons for your answer. 
Q69a 


Do you envisage any feasibility challenges to online services delivering this standard? 
Q70 Yes 


No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q70a 


Do you think this standard requires a transition period of any longer than 3 
months after the code comes into force? 


Q71 (©) Yes 
No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q71a 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Q72 Yes 
© No 
If yes, then please provide details (including links). 
Q72a 


filing: Switch options which use profiling off by default (unless you can 
demonstrate a compelling reason for profiling, taking account of the best 
interests of the child). Only allow profiling if you have appropriate measures in 
place to protect the child from any harmful effects (in particular, being fed 
content that is detrimental to their health or wellbeing). 


Q73 I would like to respond to this standard 


© Skip 


Have we communicated our expectations for this standard clearly? 
Q74 ©) Yes 
No 
If no, then please give reasons for your answer. 
Q74a 


Q75 


Q75a 


Q76 


Q76a 


Q77 


Q77a 


Q78 


Q78a 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Yes 


No 
If yes, then please give reasons for your answer. 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 

Yes 

No 
If yes, then please give reasons for your answer. 


Do you envisage any feasibility challenges to online services delivering this standard? 
Yes 


No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 
Yes 


No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Q79 Yes 
J No 
If yes, then please provide details (including links). 
Q79a 


Judge ques: Do not use nudge techniques to lead or encourage children 
to EY unnecessary personal data, weaken or turn off privacy protections, 
or extend use. 


Q80 I would like to respond to this standard 


© Skip 


Have we communicated our expectations for this standard clearly? 
Q81 Yes 
l No 
If no, then please give reasons for your answer. 


Q8ia 
Do you have any examples that you think could be used to illustrate the 
approach we are advocating to this standard? 
Q82 Yes 
© No 
If yes, then please give reasons for your answer. 
Q82a 
Do you think this standard gives rise to any unwarranted or unintended 
consequences? 
Q83 Yes 
J) No 
If yes, then please give reasons for your answer. 
Q83a 
Do you envisage any feasibility challenges to online services delivering this 
standard? 
Q84 `) Yes 


No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q84a 


Do you think this standard requires a transition period of any longer than 3 
months after the code comes into force? 


Q85 ©) Yes 
`) No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 
Q85a 


Do you know of any online resources that you think could be usefully linked to 
from this section of the code? 


Q86 ) Yes 

~) No 

If yes, then please provide details (including links). 
Q86a 


inected toys and devices: If you provide a connected toy or device ensure 
you include effective tools to enable compliance with this code 


Q87 ’ I would like to respond to this standard 


© skip 


Have we communicated our expectations for this standard clearly? 
Q88 () Yes 
© No 
If no, then please give reasons for your answer. 
Q88a 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Q89 () Yes 
` No 
If yes, then please give reasons for your answer. 
Q89a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Q90 () Yes 
`) No 
If yes, then please give reasons for your answer. 
Q90a 


Q91 


Q9ia 


Q92 


Q92a 


Q93 


Q93a 


Q94 


Q95 


Q95a 


Do you envisage any feasibility challenges to online services delivering this 
standard? 

“) Yes 

`) No 
If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 

`) Yes 

—) No 
If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 
~) Yes 
`) No 
If yes, then please provide details (including links). 


al otection in ssessments: Undertake a DPIA specifically to assess 
and mitigate risks to children one are likely to access your service, taking into 
account differing ages, capacities and development needs. Ensure that your 
DPIA builds in compliance with this code. 


' I would like to respond to this standard 


© skip 


Have we communicated our expectations for this standard clearly? 
—) Yes 

© No 
If no, then please give reasons for your answer. 


Q96 


Q96a 


Q97 


Q97a 


Q98 


Q98a 


Do you have any examples that you think could be used to illustrate the 


approach we are advocating to this standard? 


Yes 
No 
If yes, then please give reasons for your answer. 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 
) Yes 
No 
If yes, then please give reasons for your answer. 


Do you envisage any feasibility challenges to online services delivering this standard? 
Yes 


No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


Q99 _() Yes 
~) No 
If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q99a 
Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 
Q100 ©) Yes 
© No 
Q100 If yes, then please provide details (including links). 
a 


overnance and ac ntability: Ensure you have policies and procedures in 
aE which demonstrate how you comply with data protection obligations, 
including data protection training for all staff involved in the design and 
development of online services likely to be accessed by children. Ensure that 
your policies, procedures and terms of service demonstrate compliance with the 
provisions of this code 


Q101 ©) I would like to respond to this standard 


© Skip 


Have we communicated our expectations for this standard clearly? 
Q102 ©) Yes 
`) No 
Q102 If no, then please give reasons for your answer. 
a 


Q107 


Q107 
a 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Yes 


No 
If yes, then please give reasons for your answer. 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Yes 


No 
If yes, then please give reasons for your answer. 


Do you envisage any feasibility challenges to online services delivering this standard? 
Yes 


No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Do you think this standard requires a transition period of any longer than 3 
months after the code comes into force? 

Yes 

No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Do you know of any online resources that you think could be usefully linked to 
from this section of the code? 


Yes 
No 
If yes, then please provide details (including links). 


Section 3: Your views on the code sections 


Q108 © Yes 
O No 


Q108 If no, then please provide your reasons for this view. 
a 


Q109 @ Yes 
©) No 


Q109 If no, then please provide your reasons for this view. 
a 


Q110 ©) Yes 
© No 


Q110 If yes, then please provide your reasons for this view. 
a 


Q111 @ Yes 
© No 


Q111 If no, then please provide your reasons for this view. 
a 


Q112 ©) Yes 
© No 


Q112 If yes, then please provide your reasons for this view. 
a 


Q113 © Yes 
© No 


Q113 If yes, then please provide details (including links). 
a 


Q114 @ Yes 
O No 


Q114 If no, then please provide your reasons for this view. 
a 


Q115 @ Yes 
©) No 


Q115 If no, then please provide your reasons for this view. 
a 


Q116 © Yes 
© No 


Q116 If yes, then please provide your reasons for this view. 
a 


Section 4: About you 


Are you answering as: 

Q117 ©) A body representing the views or interests of children 
O A body representing the views or interests of parents 
©) A child development expert 
O An academic 
© An individual acting in another professional capacity 
O A provider of an ISS likely to be accessed by children 
O A trade association representing ISS providers 


O An individual acting in a private capacity (e.g. someone providing their views as a 
member of the public of the public or a parent)? 


O An ICO employee 
O Other 

Q117 Please specify: 

a 
Timmus Limited 


Q117 Please specify: 
b 


Q118 Dr Tabetha Newman, Social and Educational Researcher 


Thank you for responding to this consultation 
We value your input. 


